Commit bda77ac0 authored by nimrod's avatar nimrod
Browse files

Enable more modern ciphers. 

Mainly ChaCha20. Also disable AESCCM (as per
https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
it's slow and uncommon).
parent f496744b

snippets/ssl.conf

+1 −1
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ ssl_certificate /var/ssl/site.crt; 
ssl_certificate_key         /var/ssl/site.key;

ssl_dhparam                 /var/ssl/dhparams;

ssl_protocols               TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;

ssl_ciphers                 !kRSA:!3DES:!RC4:!DES:!MD5:!aNULL:!NULL:AESGCM+ECDH:AES256+ECDH:AES128:+SHA1;

ssl_ciphers                 !AESCCM:!kRSA:!3DES:!RC4:!DES:!MD5:!aNULL:!NULL:AESGCM+ECDH:ECDH+CHACHA20:AES256+ECDH:AES128:CHACHA20:+SHA1;

ssl_prefer_server_ciphers   on;

ssl_session_cache           shared:SSL:50m;

ssl_session_timeout         5m;